qontract-reconcile 0.10.2.dev503__tar.gz → 0.10.2.dev504__tar.gz

{qontract_reconcile-0.10.2.dev503 → qontract_reconcile-0.10.2.dev504}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: qontract-reconcile
-Version: 0.10.2.dev503
+Version: 0.10.2.dev504
 Summary: Collection of tools to reconcile services with their desired state as defined in the app-interface DB.
 Project-URL: homepage, https://github.com/app-sre/qontract-reconcile
 Project-URL: repository, https://github.com/app-sre/qontract-reconcile

{qontract_reconcile-0.10.2.dev503 → qontract_reconcile-0.10.2.dev504}/reconcile/gql_definitions/common/saasherder_settings.py

@@ -23,6 +23,10 @@ query SaasherderSettings {
   settings: app_interface_settings_v1 {
     repoUrl
     hashLength
+    imagePatternsBlockRules {
+      environmentLabelSelector
+      imagePatterns
+    }
   }
 }
 """
@@ -34,9 +38,15 @@ class ConfiguredBaseModel(BaseModel):
     )
 
 
+class ImagePatternsBlockV1(ConfiguredBaseModel):
+    environment_label_selector: Json = Field(..., alias="environmentLabelSelector")
+    image_patterns: list[str] = Field(..., alias="imagePatterns")
+
+
 class AppInterfaceSettingsV1(ConfiguredBaseModel):
     repo_url: str = Field(..., alias="repoUrl")
     hash_length: int = Field(..., alias="hashLength")
+    image_patterns_block_rules: Optional[list[ImagePatternsBlockV1]] = Field(..., alias="imagePatternsBlockRules")
 
 
 class SaasherderSettingsQueryData(ConfiguredBaseModel):

{qontract_reconcile-0.10.2.dev503 → qontract_reconcile-0.10.2.dev504}/reconcile/gql_definitions/introspection.json

@@ -4567,21 +4567,11 @@
                             "name": "QuayInstance_v1",
                             "ofType": null
                         },
-                        {
-                            "kind": "OBJECT",
-                            "name": "PermissionQuayOrgTeam_v1",
-                            "ofType": null
-                        },
                         {
                             "kind": "OBJECT",
                             "name": "AppEscalationPolicy_v1",
                             "ofType": null
                         },
-                        {
-                            "kind": "OBJECT",
-                            "name": "PermissionSlackUsergroup_v1",
-                            "ofType": null
-                        },
                         {
                             "kind": "OBJECT",
                             "name": "SlackWorkspace_v1",
@@ -4697,11 +4687,6 @@
                             "name": "AutomatedActionsInstance_v1",
                             "ofType": null
                         },
-                        {
-                            "kind": "OBJECT",
-                            "name": "PermissionAutomatedActions_v1",
-                            "ofType": null
-                        },
                         {
                             "kind": "OBJECT",
                             "name": "AWSVPC_v1",
@@ -4732,11 +4717,6 @@
                             "name": "VaultAuth_v1",
                             "ofType": null
                         },
-                        {
-                            "kind": "OBJECT",
-                            "name": "PermissionGithubOrgTeam_v1",
-                            "ofType": null
-                        },
                         {
                             "kind": "OBJECT",
                             "name": "VaultPolicy_v1",
@@ -4792,11 +4772,6 @@
                             "name": "UnleashProject_v1",
                             "ofType": null
                         },
-                        {
-                            "kind": "OBJECT",
-                            "name": "FeatureToggleUnleash_v1",
-                            "ofType": null
-                        },
                         {
                             "kind": "OBJECT",
                             "name": "ResourceTemplateTest_v1",
@@ -4882,95 +4857,10 @@
                             "name": "SaasResourceTemplateTargetReference_v2",
                             "ofType": null
                         },
-                        {
-                            "kind": "OBJECT",
-                            "name": "PipelinesProviderTekton_v1",
-                            "ofType": null
-                        },
                         {
                             "kind": "OBJECT",
                             "name": "PipelinesProviderTektonProviderDefaults_v1",
                             "ofType": null
-                        },
-                        {
-                            "kind": "OBJECT",
-                            "name": "OidcPermissionVault_v1",
-                            "ofType": null
-                        },
-                        {
-                            "kind": "OBJECT",
-                            "name": "OidcPermissionAcs_v1",
-                            "ofType": null
-                        },
-                        {
-                            "kind": "OBJECT",
-                            "name": "PermissionGithubOrg_v1",
-                            "ofType": null
-                        },
-                        {
-                            "kind": "OBJECT",
-                            "name": "PermissionJenkinsRole_v1",
-                            "ofType": null
-                        },
-                        {
-                            "kind": "OBJECT",
-                            "name": "PermissionGitlabGroupMembership_v1",
-                            "ofType": null
-                        },
-                        {
-                            "kind": "OBJECT",
-                            "name": "EndpointMonitoringProviderBlackboxExporter_v1",
-                            "ofType": null
-                        },
-                        {
-                            "kind": "OBJECT",
-                            "name": "EndpointMonitoringProviderSignalFx_v1",
-                            "ofType": null
-                        },
-                        {
-                            "kind": "OBJECT",
-                            "name": "AutomatedActionActionList_v1",
-                            "ofType": null
-                        },
-                        {
-                            "kind": "OBJECT",
-                            "name": "AutomatedActionCreateToken_v1",
-                            "ofType": null
-                        },
-                        {
-                            "kind": "OBJECT",
-                            "name": "AutomatedActionExternalResourceFlushElastiCache_v1",
-                            "ofType": null
-                        },
-                        {
-                            "kind": "OBJECT",
-                            "name": "AutomatedActionExternalResourceRdsReboot_v1",
-                            "ofType": null
-                        },
-                        {
-                            "kind": "OBJECT",
-                            "name": "AutomatedActionExternalResourceRdsSnapshot_v1",
-                            "ofType": null
-                        },
-                        {
-                            "kind": "OBJECT",
-                            "name": "AutomatedActionNoOp_v1",
-                            "ofType": null
-                        },
-                        {
-                            "kind": "OBJECT",
-                            "name": "AutomatedActionOpenshiftTriggerCronjob_v1",
-                            "ofType": null
-                        },
-                        {
-                            "kind": "OBJECT",
-                            "name": "AutomatedActionOpenshiftWorkloadDelete_v1",
-                            "ofType": null
-                        },
-                        {
-                            "kind": "OBJECT",
-                            "name": "AutomatedActionOpenshiftWorkloadRestart_v1",
-                            "ofType": null
                         }
                     ]
                 },
@@ -18583,11 +18473,6 @@
                             "kind": "INTERFACE",
                             "name": "Permission_v1",
                             "ofType": null
-                        },
-                        {
-                            "kind": "INTERFACE",
-                            "name": "DatafileObject_v1",
-                            "ofType": null
                         }
                     ],
                     "enumValues": null,
@@ -19184,11 +19069,6 @@
                             "kind": "INTERFACE",
                             "name": "Permission_v1",
                             "ofType": null
-                        },
-                        {
-                            "kind": "INTERFACE",
-                            "name": "DatafileObject_v1",
-                            "ofType": null
                         }
                     ],
                     "enumValues": null,
@@ -27985,11 +27865,6 @@
                             "kind": "INTERFACE",
                             "name": "Permission_v1",
                             "ofType": null
-                        },
-                        {
-                            "kind": "INTERFACE",
-                            "name": "DatafileObject_v1",
-                            "ofType": null
                         }
                     ],
                     "enumValues": null,
@@ -29551,11 +29426,6 @@
                             "kind": "INTERFACE",
                             "name": "Permission_v1",
                             "ofType": null
-                        },
-                        {
-                            "kind": "INTERFACE",
-                            "name": "DatafileObject_v1",
-                            "ofType": null
                         }
                     ],
                     "enumValues": null,
@@ -32224,11 +32094,6 @@
                             "kind": "INTERFACE",
                             "name": "FeatureToggle_v1",
                             "ofType": null
-                        },
-                        {
-                            "kind": "INTERFACE",
-                            "name": "DatafileObject_v1",
-                            "ofType": null
                         }
                     ],
                     "enumValues": null,
@@ -51163,11 +51028,6 @@
                             "kind": "INTERFACE",
                             "name": "PipelinesProvider_v1",
                             "ofType": null
-                        },
-                        {
-                            "kind": "INTERFACE",
-                            "name": "DatafileObject_v1",
-                            "ofType": null
                         }
                     ],
                     "enumValues": null,
@@ -51903,11 +51763,6 @@
                             "kind": "INTERFACE",
                             "name": "OidcPermission_v1",
                             "ofType": null
-                        },
-                        {
-                            "kind": "INTERFACE",
-                            "name": "DatafileObject_v1",
-                            "ofType": null
                         }
                     ],
                     "enumValues": null,
@@ -52073,11 +51928,6 @@
                             "kind": "INTERFACE",
                             "name": "OidcPermission_v1",
                             "ofType": null
-                        },
-                        {
-                            "kind": "INTERFACE",
-                            "name": "DatafileObject_v1",
-                            "ofType": null
                         }
                     ],
                     "enumValues": null,
@@ -52215,11 +52065,6 @@
                             "kind": "INTERFACE",
                             "name": "Permission_v1",
                             "ofType": null
-                        },
-                        {
-                            "kind": "INTERFACE",
-                            "name": "DatafileObject_v1",
-                            "ofType": null
                         }
                     ],
                     "enumValues": null,
@@ -52377,11 +52222,6 @@
                             "kind": "INTERFACE",
                             "name": "Permission_v1",
                             "ofType": null
-                        },
-                        {
-                            "kind": "INTERFACE",
-                            "name": "DatafileObject_v1",
-                            "ofType": null
                         }
                     ],
                     "enumValues": null,
@@ -52563,11 +52403,6 @@
                             "kind": "INTERFACE",
                             "name": "Permission_v1",
                             "ofType": null
-                        },
-                        {
-                            "kind": "INTERFACE",
-                            "name": "DatafileObject_v1",
-                            "ofType": null
                         }
                     ],
                     "enumValues": null,
@@ -53651,11 +53486,6 @@
                             "kind": "INTERFACE",
                             "name": "EndpointMonitoringProvider_v1",
                             "ofType": null
-                        },
-                        {
-                            "kind": "INTERFACE",
-                            "name": "DatafileObject_v1",
-                            "ofType": null
                         }
                     ],
                     "enumValues": null,
@@ -53876,11 +53706,6 @@
                             "kind": "INTERFACE",
                             "name": "EndpointMonitoringProvider_v1",
                             "ofType": null
-                        },
-                        {
-                            "kind": "INTERFACE",
-                            "name": "DatafileObject_v1",
-                            "ofType": null
                         }
                     ],
                     "enumValues": null,
@@ -54769,11 +54594,6 @@
                             "kind": "INTERFACE",
                             "name": "AutomatedAction_v1",
                             "ofType": null
-                        },
-                        {
-                            "kind": "INTERFACE",
-                            "name": "DatafileObject_v1",
-                            "ofType": null
                         }
                     ],
                     "enumValues": null,
@@ -54946,11 +54766,6 @@
                             "kind": "INTERFACE",
                             "name": "AutomatedAction_v1",
                             "ofType": null
-                        },
-                        {
-                            "kind": "INTERFACE",
-                            "name": "DatafileObject_v1",
-                            "ofType": null
                         }
                     ],
                     "enumValues": null,
@@ -55112,11 +54927,6 @@
                             "kind": "INTERFACE",
                             "name": "AutomatedAction_v1",
                             "ofType": null
-                        },
-                        {
-                            "kind": "INTERFACE",
-                            "name": "DatafileObject_v1",
-                            "ofType": null
                         }
                     ],
                     "enumValues": null,
@@ -55321,11 +55131,6 @@
                             "kind": "INTERFACE",
                             "name": "AutomatedAction_v1",
                             "ofType": null
-                        },
-                        {
-                            "kind": "INTERFACE",
-                            "name": "DatafileObject_v1",
-                            "ofType": null
                         }
                     ],
                     "enumValues": null,
@@ -55487,11 +55292,6 @@
                             "kind": "INTERFACE",
                             "name": "AutomatedAction_v1",
                             "ofType": null
-                        },
-                        {
-                            "kind": "INTERFACE",
-                            "name": "DatafileObject_v1",
-                            "ofType": null
                         }
                     ],
                     "enumValues": null,
@@ -55629,11 +55429,6 @@
                             "kind": "INTERFACE",
                             "name": "AutomatedAction_v1",
                             "ofType": null
-                        },
-                        {
-                            "kind": "INTERFACE",
-                            "name": "DatafileObject_v1",
-                            "ofType": null
                         }
                     ],
                     "enumValues": null,
@@ -55795,11 +55590,6 @@
                             "kind": "INTERFACE",
                             "name": "AutomatedAction_v1",
                             "ofType": null
-                        },
-                        {
-                            "kind": "INTERFACE",
-                            "name": "DatafileObject_v1",
-                            "ofType": null
                         }
                     ],
                     "enumValues": null,
@@ -56004,11 +55794,6 @@
                             "kind": "INTERFACE",
                             "name": "AutomatedAction_v1",
                             "ofType": null
-                        },
-                        {
-                            "kind": "INTERFACE",
-                            "name": "DatafileObject_v1",
-                            "ofType": null
                         }
                     ],
                     "enumValues": null,
@@ -56241,11 +56026,6 @@
                             "kind": "INTERFACE",
                             "name": "AutomatedAction_v1",
                             "ofType": null
-                        },
-                        {
-                            "kind": "INTERFACE",
-                            "name": "DatafileObject_v1",
-                            "ofType": null
                         }
                     ],
                     "enumValues": null,

{qontract_reconcile-0.10.2.dev503 → qontract_reconcile-0.10.2.dev504}/reconcile/openshift_saas_deploy.py

@@ -30,6 +30,7 @@ from reconcile.utils.gitlab_api import GitLabApi
 from reconcile.utils.json import json_dumps
 from reconcile.utils.openshift_resource import ResourceInventory
 from reconcile.utils.saasherder import SaasHerder
+from reconcile.utils.saasherder.models import ImagePatternsBlockRule
 from reconcile.utils.secret_reader import create_secret_reader
 from reconcile.utils.semver_helper import make_semver
 from reconcile.utils.slack_api import SlackApi
@@ -211,6 +212,13 @@ def run(
         jenkins_map=jenkins_map,
         state=init_state(integration=QONTRACT_INTEGRATION, secret_reader=secret_reader),
         all_saas_files=saas_file_list.saas_files,
+        image_patterns_block_rules=[
+            ImagePatternsBlockRule(
+                environment_label_selector=rule.environment_label_selector or {},
+                image_patterns=rule.image_patterns,
+            )
+            for rule in (saasherder_settings.image_patterns_block_rules or [])
+        ],
     )
     if defer:
         defer(saasherder.cleanup)

{qontract_reconcile-0.10.2.dev503 → qontract_reconcile-0.10.2.dev504}/reconcile/utils/saasherder/interfaces.py

@@ -194,6 +194,7 @@ class SaasEnvironment_SaasSecretParameters(Protocol):
 @runtime_checkable
 class SaasEnvironment(HasParameters, HasSecretParameters, Protocol):
     name: str
+    labels: dict[str, str] | None
 
 
 class SaasResourceTemplateTargetNamespace(Protocol):

{qontract_reconcile-0.10.2.dev503 → qontract_reconcile-0.10.2.dev504}/reconcile/utils/saasherder/models.py

@@ -290,6 +290,14 @@ class ImageAuth:
             }
 
 
+@dataclass(frozen=True)
+class ImagePatternsBlockRule:
+    """Block rule for image patterns based on environment label selectors."""
+
+    environment_label_selector: dict[str, str]
+    image_patterns: list[str]
+
+
 @dataclass
 class TargetSpec:
     saas_file: SaasFile

{qontract_reconcile-0.10.2.dev503 → qontract_reconcile-0.10.2.dev504}/reconcile/utils/saasherder/saasherder.py

@@ -70,6 +70,7 @@ from reconcile.utils.saasherder.interfaces import (
 from reconcile.utils.saasherder.models import (
     Channel,
     ImageAuth,
+    ImagePatternsBlockRule,
     Namespace,
     Promotion,
     SLOKey,
@@ -130,7 +131,8 @@ class SaasHerder:
         validate: bool = False,
         include_trigger_trace: bool = False,
         all_saas_files: Iterable[SaasFile] | None = None,
-    ):
+        image_patterns_block_rules: list[ImagePatternsBlockRule] | None = None,
+    ) -> None:
         self.error_registered = False
         self.saas_files = saas_files
         self.repo_urls = self._collect_repo_urls()
@@ -156,6 +158,9 @@ class SaasHerder:
         self.images: set[str] = set()
         self.blocked_versions = self._collect_blocked_versions()
         self.hotfix_versions = self._collect_hotfix_versions()
+        self.image_patterns_block_rules: list[ImagePatternsBlockRule] = (
+            image_patterns_block_rules or []
+        )
 
         # each namespace is in fact a target,
         # so we can use it to calculate.
@@ -1187,6 +1192,73 @@ class SaasHerder:
             )
         return None
 
+    def _is_block_rule_violated(
+        self,
+        block_rule: ImagePatternsBlockRule,
+        env_labels: dict[str, str] | None,
+        images: set[str],
+        spec: TargetSpec,
+    ) -> bool:
+        """Check if a block rule is violated for the given environment and images.
+
+        Args:
+            block_rule: Block rule with environmentLabelSelector and imagePatterns
+            env_labels: Environment labels dictionary
+            images: Set of image URLs to check
+            spec: TargetSpec for error reporting
+
+        Returns:
+            True if rule is violated, False otherwise
+        """
+        if not env_labels:
+            return False
+
+        # Check if environment labels match the selector
+        env_selector = block_rule.environment_label_selector or {}
+        if not all(env_labels.get(key) == value for key, value in env_selector.items()):
+            return False
+
+        # Check if any images match blocked patterns
+        blocked_images = [
+            image
+            for image in images
+            if any(image.startswith(pattern) for pattern in block_rule.image_patterns)
+        ]
+
+        if blocked_images:
+            logging.error(
+                f"{spec.error_prefix} Target contains blocked image patterns "
+                f"({', '.join(block_rule.image_patterns)}) for environment matching "
+                f"selector {env_selector}: {', '.join(blocked_images)}. "
+                f"These images are not allowed in this environment."
+            )
+            return True
+
+        return False
+
+    def _check_blocked_image_patterns(
+        self,
+        spec: TargetSpec,
+        images_set: set[str],
+    ) -> bool:
+        """Check if images violate any block rules for the given spec.
+
+        Args:
+            spec: TargetSpec with target and environment information
+            images_set: Set of image URLs to check
+
+        Returns:
+            True if any violations are found, False otherwise
+        """
+        if not self.image_patterns_block_rules or not images_set:
+            return False  # no rules configured or no images, no violations
+
+        env_labels = spec.target.namespace.environment.labels
+        return any(
+            self._is_block_rule_violated(block_rule, env_labels, images_set, spec)
+            for block_rule in self.image_patterns_block_rules
+        )
+
     def _check_images(
         self,
         spec: TargetSpec,
@@ -1199,6 +1271,12 @@ class SaasHerder:
         self.images.update(images_set)
         if not images_set:
             return False  # no errors
+
+        # Check blocked image patterns
+        if self._check_blocked_image_patterns(spec, images_set):
+            return True  # violations found
+
+        # imagePatterns validation
         images = threaded.run(
             self._get_image,
             images_set,